diff --git a/CHANGELOG.md b/CHANGELOG.md
index dc028c416..cc5189b97 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -109,21 +109,22 @@ BUG FIXES:
 
  * core: Correct the previous fix for a bug causing "attribute not found" messages during destroy, as it was insufficient [GH-6599]
  * core: Fix issue causing syntax errors interpolating count attribute when value passed between modules [GH-6833]
+ * provider/aws: Changing keys in `aws_dynamodb_table` correctly force new resources [GH-6829]
+ * provider/aws: Fix a bug where CloudWatch alarms are created repeatedly if the user does not have permission to use the the DescribeAlarms operation [GH-7227]
  * provider/aws: Fix crash in `aws_elasticache_parameter_group` occuring following edits in the console [GH-6687]
+ * provider/aws: Fix issue reattaching a VPN gateway to a VPC [GH-6987]
+ * provider/aws: Fix issue with Root Block Devices and encrypted flag in Launch Configurations [GH-6512]
+ * provider/aws: If more ENIs are attached to `aws_instance`, the one w/ DeviceIndex `0` is always used in context of `aws_instance` (previously unpredictable) [GH-6761]
+ * provider/aws: Make 'stage_name' required in api_gateway_deployment [GH-6797]
+ * provider/aws: Mark Lambda function as gone when it's gone [GH-6924]
  * provider/aws: Trim trailing `.` from `name` in `aws_route53_record` resources to prevent spurious diffs [GH-6592]
+ * provider/aws: Update Lambda functions on name change [GH-7081]
  * provider/aws: Updating state when `aws_sns_topic_subscription` is missing [GH-6629]
  * provider/aws: `aws_codedeploy_deployment_group` panic when setting `on_premises_instance_tag_filter` [GH-6617]
+ * provider/aws: `aws_db_instance` now defaults `publicly_accessible` to false [GH-7117]
  * provider/aws: `aws_opsworks_application.app_source` SSH key is write-only [GH-6649]
  * provider/aws: fix Elastic Beanstalk `cname_prefix` continual plans [GH-6653]
  * provider/aws: fix aws_security_group_rule refresh [GH-6730]
- * provider/aws: If more ENIs are attached to `aws_instance`, the one w/ DeviceIndex `0` is always used in context of `aws_instance` (previously unpredictable) [GH-6761]
- * provider/aws: Fix issue with Root Block Devices and encrypted flag in Launch Configurations [GH-6512]
- * provider/aws: Mark Lambda function as gone when it's gone [GH-6924]
- * provider/aws: Make 'stage_name' required in api_gateway_deployment [GH-6797]
- * provider/aws: Changing keys in `aws_dynamodb_table` correctly force new resources [GH-6829]
- * provider/aws: Fix issue reattaching a VPN gateway to a VPC [GH-6987]
- * provider/aws: Update Lambda functions on name change [GH-7081]
- * provider/aws: `aws_db_instance` now defaults `publicly_accessible` to false [GH-7117]
  * provider/azurerm: Fixes terraform crash when using SSH keys with `azurerm_virtual_machine` [GH-6766]
  * provider/azurerm: Fix a bug causing 'diffs do not match' on `azurerm_network_interface` resources [GH-6790]
  * provider/azurerm: Normalizes `availability_set_id` casing to avoid spurious diffs in `azurerm_virtual_machine` [GH-6768]